Loading patent…
AssigneeNetApp, Inc.
InventorAzzedine Benameur
Estimating the term…
Systems and methods for enhancing container security are provided by reducing the attack surface. In one example, the exposure of containers to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by an application via performance of static symbol analysis by examining a section of an executable to identify dynamically loaded symbols corresponding to functions contained within shared libraries. Based on a given shared library's usage of functions within standard libraries and a known mapping between functions of standard libraries and system calls, those system calls potentially accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Thereafter, the security policy enforced by the kernel security module may be refined based on performance of dynamic symbol analysis to identify system calls that are actually called by the application during runtime.
A method of reducing one or more security vulnerabilities to which an application associated with a container image is exposed, the method comprising:
A non-transitory machine readable medium storing instructions, for reducing one or more security vulnerabilities to which an application associated with a container image is exposed, which when executed by one or more processing resources of a system, cause the system to:
A system comprising:
Dependencies are inferred from the claim text.